THREATNOIR
Subscribe
MITRE ATT&CK · T1113

Screen Capture

MITRE · cited in 5 of our lessons

Explanation

What attackers do. Attackers take screenshots of a user's desktop to collect information they can see on screen, such as documents, messages or credentials. This serves the Collection tactic.

How to defend. Use endpoint protection that detects screen capture by unknown processes, apply operating system privacy controls that require approval for screen recording, and restrict remote access tools. Collect endpoint telemetry centrally so a capture can be tied to the process and user behind it. On macOS and Windows, review which applications have been granted screen recording permission.

Signs to look for. Look for unknown processes calling screen capture functions, image files created repeatedly in temp folders and screenshots being uploaded. A common gap is that legitimate tools also capture screens, so detection depends on knowing which processes are expected.

Open the technique on MITRE ATT&CK
The official text
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen`, `xwd`, or `screencapture`.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.